home

www.your-tornado-file.org

Domain Information

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
your-tornado-file.org

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.ShetefSolutionsConsulting1998.X
100.00%

Dr.Web
Adware.Downware.8996
100.00%

Malwarebytes
PUP.Optional.Amonetize
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

NANO AntiVirus
Riskware.Win32.Downware.difhzb
100.00%

Agnitum Outpost
PUA.Amonetize
100.00%

Sophos
Generic PUA KM
100.00%

Avira AntiVirus
ADWARE/Adware.Gen4
100.00%

AhnLab V3 Security
PUP/Win32.Amonetiz
100.00%

ESET NOD32
Win32/Amonetize.BY (variant)
100.00%

Fortinet FortiGate
Riskware/Amonetize
100.00%

AVG
Generic
100.00%

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
100.00%

The domain www.your-tornado-file.org has been seen to resolve to the following IP address.

54.214.33.160
ec2-54-214-33-160.us-west-2.compute.amazonaws.com
December 26, 2014

File downloads found at URLs served by www.your-tornado-file.org.

13 / 68    (Adware)
http://www.your-tornado-file.org/allddT.html?ref=www.winmediaplayer.com&version=1.1.5.55&direct=1&campid=3954&prefix=VLCMediaPlayer&ti1=[clickID]&capp=MediaPlayer  (mediaplayer__5647_il176.exe)

The following 2 files have been seen to comunicate with www.your-tornado-file.org in live environments.

TCP » 54.214.33.160:80
new_chrome.exe (Google Chrome by Google)

TCP » 54.214.33.160:80
Project1.exe (Pino by Microsoft)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.